Skip to content

chore(deps): update directus/directus docker tag to v12 - #688

Open
renovate[bot] wants to merge 1 commit into
developmentfrom
renovate/directus-directus-12.x
Open

chore(deps): update directus/directus docker tag to v12#688
renovate[bot] wants to merge 1 commit into
developmentfrom
renovate/directus-directus-12.x

Conversation

@renovate

@renovate renovate Bot commented Jun 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Update Change
directus/directus major 11.17.4 → 12.3.0

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

directus/directus (directus/directus)

v12.3.0

Compare Source

⚠️ Potential Breaking Changes

Fixed storage connections leaking when asset requests were cancelled or a transformation failed, which eventually made every asset request return a permission error until Directus was restarted (#​28076)
exists() now throws when the lookup itself fails, for example on a timeout, a connection error or rejected credentials, instead of also reporting false. Callers that relied on a false result for any failure need to handle the error. Note that S3 answers 403 rather than 404 for a missing object when the credentials cannot list the bucket, so granting s3:ListBucket is needed to keep getting a clean "missing" answer.

Fixed "Update Items" and "Delete Items" operations affecting every item in a collection when given an empty or missing key or query (#​27759)
Nothing to target is a no-op

"Update Items" and "Delete Items" operations now return null instead of falling back to every item whenever the configuration doesn't target anything — that is, when key is empty or missing (e.g. [], "") and query is empty or missing (e.g. {}). "Update Items" additionally returns null when there is nothing to write, i.e. an empty or missing payload (e.g. {}, or [] for a batch payload). Flows that relied on the previous fallback to every item can use {"limit": -1}.

Contradictory options error

"Update Items" and "Delete Items" operations now throw an error when both key and query are defined. "Update Items" also throws when key or query is combined with a batch payload.

Updated ASSETS_TRANSFORM_IMAGE_MAX_OUTPUT_DIMENSION to match ASSETS_TRANSFORM_IMAGE_MAX_DIMENSION (6000 px) (#​28111)
The default maximum output dimension is now 6000 px. Users who rely on the previous limit of 3000 px can explicitly configure ASSETS_TRANSFORM_IMAGE_MAX_OUTPUT_DIMENSION.

Used the pm2 bundled with @directus/api in the Docker images instead of installing a separate copy, so its dependencies follow the versions pinned by the workspace (#​28120)
If you extend the Docker image: it now boots via CMD ["node", "docker-entrypoint.cjs"], which runs the same bootstrap then pm2-runtime sequence as before. pm2-runtime is no longer on the PATH, so a custom CMD that called it directly should hand off to docker-entrypoint.cjs instead. pm2 itself remains on the PATH for docker exec diagnostics.

✨ New Features & Improvements
🐛 Bug Fixes & Optimizations
📦 Published Versions
  • @directus/app@17.1.0
  • @directus/api@39.0.0
  • @directus/cli@12.2.0
  • @directus/composables@11.6.1
  • create-directus-extension@12.1.3
  • @directus/env@6.2.1
  • @directus/errors@2.5.1
  • @directus/extensions@4.0.3
  • @directus/extensions-registry@4.0.3
  • @directus/extensions-sdk@18.0.3
  • @directus/memory@4.0.3
  • @directus/pressure@4.0.3
  • @directus/release-notes-generator@3.0.1
  • @directus/schema@14.0.2
  • @directus/schema-builder@1.0.2
  • @directus/specs@15.1.1
  • @directus/storage-driver-azure@13.0.3
  • @directus/storage-driver-cloudinary@14.0.0
  • @directus/storage-driver-gcs@13.0.3
  • @directus/storage-driver-local@14.0.0
  • @directus/storage-driver-s3@14.0.0
  • @directus/storage-driver-supabase@5.0.0
  • @directus/stores@3.0.1
  • @directus/themes@2.0.3
  • @directus/types@16.2.0
  • @directus/utils@13.5.3
  • @directus/validation@3.0.3
  • @directus/sdk@25.0.0

v12.2.0

Compare Source

⚠️ Potential Breaking Changes

Restricted the settings fields readable with minimal app access to those actually needed by non-admin users, no longer exposing admin-only and sensitive AI configuration fields (#​27996)
The minimal app permissions now grant read access to only a subset of directus_settings fields. This applies to new policies, existing policies are untouched.

Replaced the TinyMCE editor powering the WYSIWYG with Tiptap... (#​27754)
The WYSIWYG interface now runs on Tiptap instead of TinyMCE

  • tinymceOverrides no longer has any effect. Stored values are kept and a console warning is logged, but the editor ignores them. Use the fontsize/fontfamily toolbar menus and customFormats instead.
  • TinyMCE is no longer bundled with the app, so anything depending on it (custom plugins, skins, content CSS, the global tinymce object) no longer applies.
  • Existing content that contains markup the editor would normalize now locks the field read-only until the warning dialog is confirmed. Editing and autosave are blocked while locked, including raw-value editing.

Fixed deployment webhooks resolving a project from the wrong provider when external IDs collide (#​27816)
The DeploymentProjectsService.readByExternalId method now takes the deployment ID as its first argument (i.e. readByExternalId(deploymentId, externalId))

Added support for multi-collection flat data imports (#​27984)
Import file size is now capped by default
A new IMPORT_MAX_FILE_SIZE environment variable (default: 50mb) limits the size of uploaded import files and schema snapshots. Previously, imports were effectively unrestricted, allowing files larger than 50mb to be processed. With this change, imports exceeding the configured limit will be rejected. Increase IMPORT_MAX_FILE_SIZE to restore the previous behavior.

Updated background query flag handling for POST /utils/import/:collection
The background query flag now treats a valueless indicator (i.e. ?background) as true. If you previously relied on a valueless background flag being interpreted as false, pass an explicit value instead (i.e. ?background=false).

Added a mode parameter and partial snapshot support to the schema diff endpoint (#​27984)
The SDK schemaDiff command now takes its options as an object (schemaDiff(snapshot, { force, mode }))

Added support for restricting image transformation output size via ASSETS_TRANSFORM_IMAGE_MAX_OUTPUT_DIMENSION (#​27995)
Image transformation output is now restricted
Image transformations that project an output larger than ASSETS_TRANSFORM_IMAGE_MAX_OUTPUT_DIMENSION (default 3000 px) on either axis are now rejected with an IllegalAssetTransformationError.

  • @​directus/app

    • Replaced the TinyMCE editor powering the WYSIWYG with Tiptap (#​27754 by @​alvarosabu)

      To avoid data loss, the editor preserves attributes (class, id, title, role, lang, dir, data-*, aria-*) and non-schema semantic tags. If stored HTML still contains markup the editor would normalize, the field is locked read-only with a warning dialog, so no edit or autosave can rewrite it before you confirm; raw-value editing is disabled while locked so the warning can't be bypassed.

  • @​directus/api
    • Restricted the settings fields readable with minimal app access to those actually needed by non-admin users, no longer exposing admin-only and sensitive AI configuration fields (#​27996 by @​br41nslug)
    • Fixed deployment webhooks resolving a project from the wrong provider when external IDs collide (#​27816 by @​MahinAnowar)
    • Added support for multi-collection flat data imports (#​27984 by @​ComfortablyCoding)
    • Added support for restricting image transformation output size via ASSETS_TRANSFORM_IMAGE_MAX_OUTPUT_DIMENSION (#​27995 by @​br41nslug)
  • @​directus/sdk
✨ New Features & Improvements
🐛 Bug Fixes & Optimizations
  • @​directus/app
    • Fixed the translations split view hiding the second language when resizing the window (#​27681 by @​valerkahere)
    • Fixed geometry fields losing their subtype on schema changes (#​27828 by @​rajkumar0932)
    • Fixed stale dynamic permission presets after editing current account (#​27899 by @​scarab-systems)
    • Fixed a type error in the module bar default configuration (#​27944 by @​kheiner)
    • Amended app's save-as-copy logic to not create new items when only adjusting order on relationals (#​27871 by @​AlexGaillard)
    • Fixed the auth module registering a permanent cookie polling interval (#​27851 by @​dstockton)
    • Fixed presentation fields allowing required and/or readonly to be set (#​27688 by @​sourav-18)
    • Fixed missing translations for the Datetime display timezone options (#​28000 by @​lazerg)
    • Fixed dropdown menus shifting position when flipped above their trigger. (#​27958 by @​Harshith-muddasani)
    • Updated the remaining *.io references to the current *.com domains where possible (#​27948 by @​kheiner)
    • Updated the onboarding flow to replace the Privacy Policy link with the Data Processing Agreement (#​27934 by @​JamesW1)
    • Fixed live preview requesting a draft version before it exists, which caused a forbidden error (#​27848 by @​dstockton)
    • Fixed issue causing singleton primary key mismatch (#​27919 by @​robluton)
    • Restricted the settings fields readable with minimal app access to those actually needed by non-admin users, no longer exposing admin-only and sensitive AI configuration fields (#​27996 by @​br41nslug)
    • Fixed many-to-one fields to display the saved key when the referenced item is inaccessible due to permissions (#​27899 by @​scarab-systems)
    • Fixed a Forbidden error when publishing an itemless content version without delete permission on directus_versions (#​27892 by @​alex-hsieh)
  • @​directus/api

    • Updated the remaining *.io references to the current *.com domains where possible (#​27948 by @​kheiner)

    • Added global setting for default save action (#​27993 by @​robluton)

    • Fixed OpenAPI spec error schema to match API error format (#​27885 by @​kheiner)

    • Restricted license key previews to administrators after initial project setup (#​27886 by @​ComfortablyCoding)

    • Stopped logging the missing custom IP header warning on /server/ping and /server/info, which are commonly hit directly (health checks) (#​27903 by @​dstockton)

    • Updated axios, sharp, liquidjs, js-yaml, minimatch, adm-zip, brace-expansion, linkify-it, fast-xml-parser and tar to address CVEs (#​27990 by @​br41nslug)

    • Fixed parsing of the deep query parameter, GraphQL nested arguments, and CSV import headers so keys dont collide with built-in object property names (#​27992 by @​br41nslug)

    • Fixed schema apply ignoring configured license (#​27869 by @​ComfortablyCoding)

    • Fixed aliased relational fields returning null in GraphQL when nested inside a Many-to-Any field (#​27864 by @​apoorva-01)

    • Fixed IP denylist not enforced for AI chat file downloads (#​27994 by @​br41nslug)

    • Fixed background imports (POST /utils/import/:collection?background=true) intermittently hanging and importing nothing when running behind a streaming proxy or CDN. (#​27862 by @​dstockton)

      Added an IMPORT_MAX_FILE_SIZE environment variable that caps the size of an uploaded import file, returning 413 Content Too Large when exceeded. Unset (unlimited) by default.

    • Fixed requests referencing duplicate primary keys resulting in forbidden error (#​27882 by @​lazerg)

    • Fixed manual flows triggerable by non authenticated users (#​27997 by @​br41nslug)

    • Fixed count, countAll, and PK counts being inflated when filtering across relations (#​27926 by @​ComfortablyCoding)

    • Fixed TUS uploads not respecting FILES_MIME_TYPE_ALLOW_LIST (#​27793 by @​amitmishra11)

    • Fixed WebSocket handlers not validating query parameters (#​27845 by @​tsushanth)

    • Fixed unnecessary schema cache rebuilds on permission-related changes (#​27876 by @​dstockton)

  • @​directus/sdk
    • Updated the remaining *.io references to the current *.com domains where possible (#​27948 by @​kheiner)
    • Fixed nested filters on relational fields losing type inference, so filtering a related collection's field (e.g. filter: { o2m: { id: { _eq: 5 } } }) is now type-checked instead of silently accepting any value (#​27815 by @​MahinAnowar)
    • Removed phantom timestamp from directus_operations (#​27942 by @​kheiner)
    • Fixed an unhandled rejection in the sdk realtime client when the connection closed during a heartbeat ping (#​27846 by @​apoorva-01)
  • @​directus/specs

    • Updated the remaining *.io references to the current *.com domains where possible (#​27948 by @​kheiner)

    • Fixed OpenAPI spec error schema to match API error format (#​27885 by @​kheiner)

    • Fixed background imports (POST /utils/import/:collection?background=true) intermittently hanging and importing nothing when running behind a streaming proxy or CDN. (#​27862 by @​dstockton)

      Added an IMPORT_MAX_FILE_SIZE environment variable that caps the size of an uploaded import file, returning 413 Content Too Large when exceeded. Unset (unlimited) by default.

    • Added missing /users registration and 2FA endpoint openapi specs (#​27857 by @​kheiner)

    • Removed OpenAPI query parameters that the underlying controllers never honor (#​27922 by @​kheiner)

    • Added missing id path parameter to the /comments/{id} OpenAPI spec (#​27884 by @​kheiner)

  • @​directus/constants
    • Updated the onboarding flow to replace the Privacy Policy link with the Data Processing Agreement (#​27934 by @​JamesW1)
  • @​directus/system-data
    • Restricted the settings fields readable with minimal app access to those actually needed by non-admin users, no longer exposing admin-only and sensitive AI configuration fields (#​27996 by @​br41nslug)
  • @​directus/env

    • Fixed background imports (POST /utils/import/:collection?background=true) intermittently hanging and importing nothing when running behind a streaming proxy or CDN. (#​27862 by @​dstockton)

      Added an IMPORT_MAX_FILE_SIZE environment variable that caps the size of an uploaded import file, returning 413 Content Too Large when exceeded. Unset (unlimited) by default.

  • @​directus/utils

    • Fixed background imports (POST /utils/import/:collection?background=true) intermittently hanging and importing nothing when running behind a streaming proxy or CDN. (#​27862 by @​dstockton)

      Added an IMPORT_MAX_FILE_SIZE environment variable that caps the size of an uploaded import file, returning 413 Content Too Large when exceeded. Unset (unlimited) by default.

  • @​directus/schema
    • Fixed MSSQL schema introspection reporting the byte size as max_length for non-character types (#​27825 by @​BIGSUS24)
  • @​directus/storage-driver-cloudinary
📦 Published Versions
  • @directus/app@17.0.0
  • @directus/api@38.0.0
  • @directus/composables@11.6.0
  • @directus/constants@14.4.1
  • create-directus-extension@12.1.2
  • @directus/env@6.2.0
  • @directus/errors@2.5.0
  • @directus/extensions@4.0.2
  • @directus/extensions-registry@4.0.2
  • @directus/extensions-sdk@18.0.2
  • @directus/memory@4.0.2
  • @directus/pressure@4.0.2
  • @directus/schema@14.0.1
  • @directus/schema-builder@1.0.1
  • @directus/specs@15.1.0
  • @directus/storage-driver-azure@13.0.2
  • @directus/storage-driver-cloudinary@13.0.2
  • @directus/storage-driver-gcs@13.0.2
  • @directus/storage-driver-s3@13.0.2
  • @directus/storage-driver-supabase@4.0.2
  • @directus/system-data@4.6.0
  • @directus/themes@2.0.2
  • @directus/types@16.1.0
  • @directus/utils@13.5.2
  • @directus/validation@3.0.2
  • @directus/sdk@24.0.0

v12.1.1

Compare Source

[!NOTE]
Directus is free for individuals and organizations under $5M annual revenue and 50 employees.
Get your free license key at directus.com/oig

🐛 Bug Fixes & Optimizations
📦 Published Versions
  • @directus/app@16.2.1
  • @directus/api@37.0.1

v12.1.0

Compare Source

[!NOTE]
Directus is free for individuals and organizations under $5M annual revenue and 50 employees.
Get your free license key at directus.com/oig

⚠️ Potential Breaking Changes
  • @​directus/api
    • Limited sensitive system mutations defined by GRAPHQL_SINGLE_USE_MUTATIONS to single use (#​27801 by @​br41nslug)
    • Removed /utils/hash/generate and /utils/hash/verify endpoints (#​27774 by @​br41nslug)
    • Fixed failed TUS file replacements leaving orphaned file records. Hardened upload path validation to prevent writes to extension and temporary storage directories (#​27803 by @​br41nslug)
    • Updated GraphQL WebSocket restrictions to match the HTTP endpoint and hid validation hints when introspection is disabled (#​27801 by @​br41nslug)
    • Added CORS_ORIGIN checks for websocket connections (#​27812 by @​br41nslug)
  • @​directus/specs
  • @​directus/sdk
  • Hardened the published Docker image and added a distroless Docker Hardened Image (DHI) variant alongside it. The standard image now applies outstanding OS-level patches at build time and drops npm/npx from the runtime; the new DHI variant is published under a -dhi tag suffix (#​27670 by @​br41nslug)
✨ New Features & Improvements
🐛 Bug Fixes & Optimizations

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot force-pushed the renovate/directus-directus-12.x branch from c354fc7 to 3e1a6f9 Compare June 12, 2026 02:07
@renovate
renovate Bot force-pushed the renovate/directus-directus-12.x branch from 3e1a6f9 to 86b2fb2 Compare June 12, 2026 21:43
@renovate
renovate Bot force-pushed the renovate/directus-directus-12.x branch from 86b2fb2 to 4cb0c44 Compare July 1, 2026 22:37
@renovate
renovate Bot force-pushed the renovate/directus-directus-12.x branch from 4cb0c44 to 57299b1 Compare July 29, 2026 22:26
@renovate
renovate Bot force-pushed the renovate/directus-directus-12.x branch from 57299b1 to 29182ab Compare August 18, 2026 20:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants